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We construct an oracular (i.e., black box) problem that can be solved exponentially faster 
on a quantum computer than on a classical computer. The quantum algorithm is based 
on a continuous time quantum walk, and thus employs a different technique from previous 
quantum algorithms based on quantum Fourier transforms. We show how to implement the 
quantum walk efficiently in our oracular setting. We then show how this quantum walk 
can be used to solve our problem by rapidly traversing a graph. Finally, we prove that no 
classical algorithm can solve this problem with high probability in subexponential time. 



I. INTRODUCTION 



A primary goal of the field of quantum computation is to determine when quantum computers 
can solve problems faster than classical computers. Exponential quantum speedup has been demon- 
strated for a number of different problems, but in each case, the quantum algorithm for solving 
the problem relies on the quantum Fourier transform. The purpose of this paper is to demonstrate 
that exponential speedup can be achieved by a different algorithmic technique, the quantum walk. 
We show that quantum walks can solve an oracular computational problem exponentially faster 
than any classical algorithm. 

Oracular problems provided the first examples of algorithmic speedup using a quantum instead 
of a classical computer. An oracular problem is specified in terms of a black box function, and the 
goal is to find some property of that function using as few queries to the black box as possible. In 
this setting, Deutsch gave an example of a problem that can be solved on a quantum computer using 
one query, but that requires two queries on a classical computer Q . Deutsch and Josza generalized 
this problem to one that can be solved exactly on a quantum computer in polynomial time, but 
for which an exact solution on a classical computer requires exponential time [||. However, this 
problem can be solved with high probability in polynomial time using a probabilistic classical 
algorithm. Bernstein and Vazirani gave the first example of a super polynomial separation between 
probabilistic classical and quantum computation ||, and Simon gave another example in which 
the separation is exponential Q. 

Quantum computers can also provide computational speedup over the best known classical 
algorithms for non-oracular problems. The first such example was provided by Shor, who gave 
polynomial-time algorithms for integer factorization and the discrete logarithm ||. A number of 
generalizations and variations of these algorithms have been discovered for solving both oracular 
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and non-oracular problems with exponential speedup (e.g., || [7|, ||, ||, 1C, 11, |T^, 13, 14, |T^]). All 
of them are fundamentally based on quantum Fourier transforms. 

We would like to find new techniques for achieving algorithmic speedup with quantum comput- 
ers. Since many classical algorithms are based on random walks, it is natural to ask whether a 
quantum analogue of a random walk process might be useful for quantum computation. This idea 
was explored by Farhi and Gutmann |l6| , who proposed the model of a quantum walk used in the 



present paper. They gave an example of a graph in which the time to propagate between two ver- 
tices (i.e., the hitting time) is exponentially faster for the quantum walk than for the corresponding 
classical random walk. A simpler example of a graph with an exponentially faster quantum hitting 
time was given in p|. However, as we explain in Section InL these results do not imply algorithmic 



speedup. In the present paper, we modify the example presented in 17] to construct an oracular 
problem that can be solved efficiently using a quantum walk, but that no classical algorithm can 
solve in sub exponential time. Although the quantum walk is defined as a continuous time quantum 
process, we show how to implement it in the conventional quantum computing paradigm with the 
structure of the graph provided in the form of an oracle. In other words, the algorithm consists 
of a polynomial-length sequence of applications of the oracle and unitary gates that act on a few 
qubits at a time. 

We note that the quantum analogue of a classical random walk is not unique, and other models 
have been proposed. Whereas the states of the continuous time quantum walk used in this paper 
lie in a Hilbert space spanned by states corresponding to the vertices in the graph, these alternative 
models operate in discrete time and make use of an extra state space (e.g., to implement a "quantum 
LIU, IS As far as we know, our results are the first example of algorithmic speedup 



com 



based on either discrete or continuous time quantum walks. 

The structure of this paper is as follows. In Section [n|, we construct a family of graphs and use 
it to define our problem. In Section III, we present a quantum algorithm for solving this problem 
in polynomial time with high probability, and in Section [TV| , we show that the problem cannot be 
solved classically in subexponential time with high probability. We conclude with a discussion of 
the results in Section |V[ 



II. THE PROBLEM 

In this section we describe in detail the problem we address in this paper. The problem involves 
determining a certain property of a graph whose structure is provided in the form of an oracle. A 
graph G is a set of N vertices and a set of edges that specify which pairs of vertices are connected. 



Our problem is based on a generalization of the graphs presented in [17]. In that paper, the 
authors consider a sequence of graphs G n consisting of two balanced binary trees of height n with 
the 2 n leaves of the left tree identified with the 2 n leaves of the right tree in the simple way shown 
in Figure [l] (for n = 4). A classical random walk starting at the left root of this graph requires 
exponentially many steps (in n) to reach the right root. However, the continuous time quantum 
walk traverses G n in a time linear in n. 

In this paper, we modify the graphs in the previous example so that the quantum walk is 
exponentially better not only than the corresponding classical random walk, but also than any 
classical algorithm one can design to traverse the graph. Before we describe the modified graphs, 
we provide an oracular (black box) setting in which graphs can be specified, and where our notion 
of an algorithm traversing a graph can be made precise. The vertices are named with randomly 



1 The term quantum random walk is somewhat misleading since the dynamics of this process are coherent, so we use 
the term quantum walk in this paper. 



FIG. 1: The graph G A . 



ENTRANCE 




EXIT 



FIG. 2: A typical graph G' 4 . 



chosen 2n-bit strings, and the oracle only refers to the vertices by their names. Because G n contains 
0(2 n ) vertices, n + 0(1) bits would be sufficient to give each vertex a unique name, but we use 
2n bits for each name so that there are exponentially more possible names than vertices in the 
graph. The oracle takes a 2n-bit string as input, and if that name corresponds to an actual vertex 
in the graph, the oracle outputs the names of the adjacent vertices. There are also two identifiable 
vertices called entrance and exit, which in the case of G n are the left root and the right root of 
the trees, respectively. The traversal problem is: 

• Given an oracle for the graph and the name of the entrance, find the name of the exit. 

However, even with G n given by such an oracle, the exit can be found in polynomial time 
using a classical algorithm that is not a random walk. The key is that we can always tell whether 
a particular vertex is in the central column by checking its degree. We begin at the entrance. 
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At each vertex, we query the oracle and move to one of the two unvisited adjacent vertices. After 
n steps, we reach the central column and then proceed moving to unvisited adjacent vertices in 
the right tree, checking the degree at each step. If we discover that after k steps we are again at 
a central vertex, we know that the wrong move happened after k/2 steps (k can only be even due 
to the structure of G n ) and we can backtrack to that point and take the other edge. After only 
0(n 2 ) steps this procedure will reach the exit. 2 

We now describe how the graphs G n are modified so that they cannot be traversed efficiently 
with a classical algorithm. We choose a graph G' n at random from a particular distribution on 
graphs. A typical graph G' n is shown in Figure [2] (for n = 4). The distribution is defined as follows. 
The graph again consists of two balanced binary trees of height n, but instead of identifying the 
leaves, they are connected by a random cycle that alternates between the leaves of the two trees. 
In other words, we choose a leaf on the left at random and connect it to a leaf on the right chosen 
at random. Then we connect the latter to a leaf on the left chosen randomly among the remaining 
ones. We continue with this procedure, alternating sides, until every leaf on the left is connected 
to two leaves on the right (and vice versa). As we will show in Section [V, no subexponential time 
classical algorithm can with non-negligible probability find the exit given the entrance and a 
typical oracle for G' n . 

We will show in Sections III C| and D [D that the quantum walk goes from entrance to exit 
in any graph G' n in polynomial time. However, to construct a quantum algorithm, we must show 
how to implement the quantum walk, i.e., how to efficiently simulate the appropriate Hamiltonian 
evolution on a quantum computer. We do this in the conventional paradigm for oracular quantum 
computation, and our implementation will work for a general graph. The algorithm will consist of 
a sequence of unitary operators that are either the oracle or act on a few qubits at a time. We 



address the general implementation issue in Section 1IIB. In order to implement the quantum 



walk on a general graph, we must also be given a consistent coloring of the edges of the graph. In 
other words, there must be k = poly(log(#vertices)) colors assigned to the edges of the graph such 
that all the edges incident on a given vertex are different colors. The input to the oracle consists 
of both the name of a vertex and a particular color, and the output name will depend on the input 



color, as explained in detail in Section [MB 



In principle, knowledge of such a coloring might help a classical algorithm solve our problem, 
because there could be correlations between the colors of the edges in different places in the graph. 
However, we will show in Section |V| that there exists a consistent (random) coloring of any graph 
G' n , using only nine colors (independent of n), that is completely useless to any classical algorithm. 
Consequently, this modification of the oracle can be made irrelevant from the classical point of 
view. For an alternative implementation of the quantum walk on the graphs G' n that does not 
require colors, see Appendix M. 



III. QUANTUM ALGORITHM 

In this section, we discuss quantum walks in general and then use them to present a quantum 
algorithm for solving our problem. We begin by describing the model of a continuous time quantum 



walk on any graph in Section [III A. We define the quantum walk to be Schrodinger evolution with 
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As an aside, we note that there is also a polynomial-time classical traversal algorithm for the n-dimensional 
hypercube (where one vertex is designated as the entrance and the exit is the unique vertex whose distance 
from entrance is n). For a description of the algorithm, see Appendix This means that there can be no 
exponential algorithmic speedup using quantum walks to traverse the hypercube, even though both continuous 
and discrete time quantum walks have been shown to reach the exit in a polynomial number of steps in a non- 
oracular setting 
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the Hamiltonian equal to (a constant multiple of) the adjacency matrix of the graph. We explain 
how to implement the quantum walk on a general graph in an oracular setting on a quantum 
computer in Section IIIB. In Section IIIC we show that the quantum walk on the graph G' n 
starting at the entrance can be viewed as propagation on a discrete line, and we give a sequence 
of arguments explaining why the walk propagates through the graph in linear time. Finally, in 
Section HID, we prove that the quantum walk reaches the exit using a polynomial number of 
calls to the oracle. 



A. Quantum walk 

We now formally describe our model of a quantum walk on a general graph G. We write a £ G 
to denote that the vertex a is in the graph and aa' G G to denote that the edge joining vertices a 
and a' is in the graph. We let d(a) denote the degree of vertex o, i.e., the number of edges incident 
on that vertex. 

Our model of a quantum walk is defined in close analogy to a continuous time classical random 
walk, which is a Markov process. In a continuous time classical random walk, there is a fixed 
probability per unit time 7 of moving to an adjacent vertex. In other words, from any vertex, the 
probability of jumping to any connected vertex in a time e is 7e (in the limit e — ► 0). If the graph 
has N vertices, this classical random walk can be described by the N x N infinitesimal generator 
matrix K defined by 

{7 a 7^ a', aa' G G 

a^a', aa' £ G (1) 

—d(a)j a = a' . 

If p a (t) is the probability of being at vertex a at time t, then 

dp a (t) 



dt 



Y^Kaa'Pa'(t). (2) 



a' 

Note that because the columns of K sum to zero, an initially normalized distribution remains 
normalized, i.e., YlaPa-i^) = 1 f° r an 

Now consider quantum evolution in an TV-dimensional Hilbert space spanned by states 
|1), |2), . . . , \N) corresponding to the vertices of G. If the Hamiltonian is H, then the dynam- 
ics of the system are determined by the Schrodinger equation, 

d_ 



^(a|^i)>=EHffk>'l<K*)>- (3) 



Note the similarity between (Q) and (|3|). A natural quantum analogue to the continuous time 
classical random walk described above is given by the Hamiltonian with matrix elements [|l(| 

(a\H\a!) = K aa , . (4) 

In the quantum case, there is no need for the columns of H to sum to zero; we only require H to 
be Hermitian. We set the diagonal to zero for simplicity. In this paper, we define a quantum walk 
in terms of a Hamiltonian with matrix elements 

l a \H\a') = { 7 a ^ a '' aa ' E ° (5) 
\0 otherwise. 

In other words, H is the adjacency matrix of the graph times 7. Because H is Hermitian, probability 
is conserved, i.e., ^ a |(o|^>(t))| 2 = 1 for all t. 
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B. Implementing the quantum walk 

In this section, we describe how to implement the quantum walk on a general graph G using 
a universal quantum computer. Our goal is to simulate the unitary evolution e~ lHt with H given 
by (||). We want to do this with the graph given to us in the form of an oracle. However, in the 
oracular setting, we have only been able to implement the quantum walk on a general graph using 
additional structure: we require that the graph comes with a consistent coloring. We assume that 
each edge of the graph is assigned a color, where the total number of colors is k = poly (log N). We 
say that a coloring is consistent if no vertex is incident with two edges of the same color. Although 
we might want to use more than the minimal number of colors for a particular application, any 
graph whose maximum degree is A can be consistently colored with at most A + 1 colors [p5f |. For 
the specific problem addressed in this paper, we will show that the oracle can provide a consistent 
coloring that cannot be used by any classical algorithm to help solve the problem, since a classical 
algorithm could make up the coloring as it goes. Alternatively, we could implement the quantum 
walk for this particular problem using a similar idea in which the coloring is generated by the 
quantum algorithm. We outline this construction in Appendix ^. 

We now give our method for implementing the quantum walk on a general graph G for which 
the oracle has assumed a particular consistent coloring of the graph. Let n = [log N~\ so it takes 
n bits to list the vertices of the graph G. In the classical setting, the black box takes two inputs, 
a name a given as a 2n-bit string and a color c. If the input name o corresponds to a vertex that 
is incident with an edge of color c, then the output is the name of the vertex joined by that edge. 
If a is not the name of a vertex or if a is the name of a vertex but there is no incident edge of 
color c, then the output is the special bit string 11 . . . 1, which is not the name of any vertex. For 
shorthand, we write v c (a) = a', where a is the input name, c is the color, and a' is the output 
name. If a 1 ^ 11 ... 1, then a' is the name of the vertex that is connected by an edge of color c to 
the vertex named a. Note that v c (v c (a)) = a for v c (a) ^ 11 ... 1, which is a crucial ingredient in 
our implementation of the quantum walk. 

The unitary quantum black box corresponding to this classical black box is described as follows. 
Let a, b be 2n-bit strings and let c be a color. Then the action of the quantum black box U associated 
with the graph G is 

U\a, 6, c) = \a, b © v c (a),c) (6) 

where © denotes bitwise addition modulo 2. However, we will never need to query U with a 
superposition of different colors, so for our purposes, it is sufficient to omit the color register and 
assume that we have access to the k unitary transformations 

U c \a, b) = \a, b © v c (a)) , (7) 

one for each of the k possible colors. Clearly, this operation can be performed using the oracle (|6|). 
In fact, by checking whether v c (a) = 11 ... 1, it is also straightforward to extend the Hilbert space 
by a single qubit and perform each of the k transformations 

V c \a, b, r) = \a, b © v c (a),r © f c (a)) , (8) 

where 



(9) 
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using only a few calls to (||). 3 In summary, for our purposes, we may view the oracle as giving us 
the ability to perform each of the k unitary transformations V c given by (H), where a, b are 2n-bit 
strings and r is a single bit. 

The Hilbert space that V c acts on in (@) has dimension 2 +1 , which is much larger than the 
number of vertices in the graph. We want the quantum evolution e~ lHt to take place in an N- 
dimensional subspace. To this end, we will show how to implement the quantum walk given the 
oracles V c in the sense that we will construct a Hamiltonian H satisfying 

H\a,0,0) = Yl Ma),0,0). (10) 

c: v c (a)£G 

This means that if we start our evolution in the subspace of states of the form \a, 0, 0) where a£G, 
then we will remain in this ^-dimensional subspace. 

In a non-oracular setting, we say we can efficiently simulate any m-qubit Hamiltonian H if we 
can approximate the unitary evolution e~ lHt for any t = poly(m) using a polynomial number of 
one- and two-qubit unitary gates. In our oracular setting, we regard a simulation of H as efficient 
if it can approximate e~ lHt for any t = poly(m) using a polynomial number of calls to the oracle 
and a polynomial number of additional one- and two-qubit gates. In general, in either setting, it is 
not easy to answer the question of whether a particular Hamiltonian can be simulated efficiently. 4 
However, there are some useful standard tools for simulating Hamiltonians. The following is a list 
of five such tools, four of which will be used in our construction. 

1. Local terms. If H acts on 0(1) qubits, it can be simulated. This is simply because any 
operator acting on a constant number of qubits can be approximated using a constant number 
of one- and two-qubit gates. 

2. Linear combination. If we can simulate Hi, . . . H^, then we can simulate H\ + • • • + as a 
result of the Lie product formula 

e -4{H 1+ ...+H k yt = (e-iH lt /j . . . e -W k t/jy +0 (k\\[H p ,H q ] \\t 2 /j), (11) 

where || [Hp, H q ] || is the largest norm of a commutator of two of the Hamiltonians. This 
is a powerful tool for the simulation of physical quantum systems, which can typically be 



expressed as a sum of local terms [ 26 1 . 



Commutation. If we can simulate H\ and H2, then we can simulate i[H\,Hi\. This is a 
consequence of the identity 

[Hi,H 2 ]t _ y fp-imt/VJ^-iHit/VJjHit/y/jJHit/Vjy 



e [Hi,n 2 \t = lim e -»iiit/VJ e -*-H2t/VJ e *«it/VJ e *-«2t/V3 _ (12) 

Using linear combination and commutation, it is possible to simulate any Hamiltonian in 
the Lie algebra generated by a set of Hamiltonians. We will not need to use commutation 
in the present paper, but we include it for completeness. 

Unitary conjugation. If we can simulate H and we can efficiently perform the uni- 
tary operation U, then we can simulate UHU^. This follows from the simple fact that 
U e -iHtjj] _ e -iUHUh_ 



3 Note that in the register containing r consists of a single qubit, as opposed to (g), in which c represents one 
of k colors. 

4 Certainly most Hamiltonians cannot be simulated efficiently, since there are many more possible m-qubit Hamil- 
tonians than strings of poly(m) one- and two-qubit gates. 
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5. Tensor product. If Hj each act on 0(1) qubits and the product of their eigenvalues is 
efficiently computable, then we can simulate • Hj. This can be done with a generalization 



of a technique discussed in Section 4.7.3 of [27]. We will not present the general construction, 
but we show its application to a specific Hamiltonian below. Note that ■ Hj may be highly 
nonlocal, so it may look very different from the Hamiltonian of a physical system. 

We now use these tools to construct the quantum walk on a graph G specified by the oracles 
V c given by @. In other words, we show how to efficiently simulate The Hilbert space will 

consist of states of the form \a, b, r), where a and b are 2n-bit strings and r is a single bit. The 
states that correspond to vertices are \a, 0, 0), where a is the name of a vertex in the graph. 

We begin by showing how to simulate the evolution generated by the Hermitian operator T 
satisfying 

T\a,b,0) = \b,a,0) (13) 
T\a,b,l) = 0. (14) 

We will use T as a building block in our simulation of H. Our simulation of T uses only 0{n) one- 
and two-qubit gates. 

The operator T may be written as 

T= |(g5('' 2n+ ''| <g> |0>(0| (15) 

where the superscript indicates which two qubits S acts on, and the projector onto |0) acts on the 
third register. Here S is a Hermitian operator on two qubits satisfying S\z\Z2) = Since the 

eigenvalues of S are ±1, the eigenvalues of T are 0, ±1, and they are easy to compute. Thus e~ tTt 
can be simulated with the circuit shown in Figure ||. In this figure, W denotes a two-qubit unitary 
operator that diagonalizes S. The unique eigenvector of S with eigenvalue —1 is ^g(|01) — 1 10) ) , 
so we take 

W\M) = |00) (16) 
W^(|01> + |10» = |01) (17) 

W^(|01>-|10» = |10> (18) 
Will) = |11). (19) 

Applying W® 2n diagonalizes T, and the Toffoli gates compute the argument of the eigenvalue in 
an ancilla register initially prepared in the state |0). Note that a filled circle denotes "control on 
and an open circle denotes "control on |0)." After computing the eigenvalue, we apply the 
appropriate phase shift if r = by evolving for a time t according to the Pauli Z operator satisfying 
Z\z) = (—l) z \z). The controlled phase shift can be performed since it is a local term. Finally, we 
uncompute the eigenvalue and return to the original basis. 
Our Hamiltonian for the quantum walk on G is 



H = Y,V}TV C (20) 



where the sum runs over all k colors. Given the simulation of T described above, this can be 
simulated using unitary conjugation and linear combination. Note that Vc = V c , so we do not need 
to separately explain how to perform Vc ■ 
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FIG. 3: A circuit for simulating e %Tt . 



To conclude, we show that ( p0| ) acts as it should to satisfy ([[(]). We have 
H\a,0,0) = ^V c T\a,v c {a),f c (a)} 

c 

= ^2 S o,f c (a)V c \v c (a),a,Q) 

c 

= ^ \v c (a),a®v c (v c (a)),f c (v c (a))). 

c: v c (a)£G 

Noting that v c (a) G G f c (v c [aj) = and v c (v c (a)) = a, this shows that 

fl-|a,0,0)= l^( a )>°'°) 

c: D c (a)eG 



(21) 
(22) 
(23) 



(24) 



as desired. 

Although the continuous time quantum walk is most naturally viewed as Schrodinger evolution 
according to a time-independent Hamiltonian, we have shown how to simulate this evolution in 
the conventional circuit model of quantum computation. Note that since the names of the vertices 
may be arbitrary, the graph Hamiltonian may not be local, but nevertheless it can be simulated in 
the circuit model. 



C. Propagation on a line 

We now consider the quantum walk on the specific family of graphs G' n of Figure 0. In this 
section, we use standard physics techniques to give compelling evidence that the quantum walk 
propagates from the entrance to the exit in linear time. We explain how the walk on G' n can 
be viewed as a walk on a finite line with a defect at the center, and we show through a series of 
examples that the defect and the boundaries do not significantly affect the walk. In section [IIP , 
we prove that the walk reaches the EXIT in polynomial time. 
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11 1 V2 1 11 

(a) ENTRANCE • • • — • • • — • • • • — • • • — • • • EXIT 

colO coll col2 coin— 1 coin coln+1 coln+2 col2n— 1 col2n col2n+l 



(b) 



(c) 



j = d+i 



111 111 
(d) • • • • — • • • — • • • • 

3 = 1 i=L 

FIG. 4: Quantum walks on lines, (a) Reduction of the quantum walk on G' n to a quantum walk on a line, 
(b) Quantum walk on an infinite, translationally invariant line, (c) Quantum walk on an infinite line with 
a defect, (d) Quantum walk on a finite line without a defect. 

The analysis of the walk on G' n is particularly simple because it can be reduced to a walk on a line 
with 2n + 2 vertices, one for each column of the original graph. Consider the (2n + 2)-dimensional 
subspace spanned by the states 

i col ^ = ^r E ( 25 ) 

where 



J aScolumn j 



^3 ~ \ 2 2n+l- J n + 1 < j < 2n + 1 . [M) 

We refer to this subspace as the column subspace. Because every vertex in column j is connected 
to the same number of vertices in column j + 1 and every vertex in column j + 1 is connected 
to the same number of vertices in column j, applying H to any state in the column subspace 
results in another state in this subspace. Despite the random connections in G' n , the column 
subspace is invariant under H. In particular, a quantum walk starting in the state corresponding 
to the entrance always remains in the column subspace. Thus, to understand the quantum walk 
starting from the ENTRANCE, we only need to understand how the Hamiltonian acts on the column 
subspace. In this subspace, the non-zero matrix elements of H are 



(col^|col( j + l)} = {^ ]z 3 n - n ~ 1 ' n + 1 ^^ 2n (27) 



(and those deduced by Hermiticity of H). For simplicity, we set 7 = 1/V2. The quantum walk in 
the column subspace is shown pictorially in Figure |](a). 

We claim that if the quantum state at t = is | colO), then at a time of order n/2, there is 
an appreciable probability of being at | col(2n + 1)). To see this, first consider propagation on an 
infinite, translationally invariant line as shown in Figure |](b). The nonzero matrix elements of the 
Hamiltonian are 



(j\H \j ± 1) = 1 , -oo<i<oo 



(28) 
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The eigenstates of this Hamiltonian are the momentum eigenstates \p) with components 

(j\p) = -±=e™ , -7T < p < n (29) 

V27T 



having energies 

E p = 2 cos p. (30) 
The propagator, or Green's function, to go from j to k in time t is 

G(j,fc,t) = (k\e- im \j) (31) 

= — [ dp e ip(.k-j)-2it cos p ( 32 ) 



2vr „ 

= {-i) k ' j J k -j{2t) , — oo < j,k < co (33) 

where J^(-) is a Bessel function of order v. By the well-known properties of the Bessel function, 
this shows that a state initially localized in a single column evolves as a left moving and a right 
moving wave packet, each propagating with speed 2. To see this, note that the Bessel function has 
the following asymptotic expansions for v 1: 

g-fCf-tanhf) 

J>sech£) ~ (34) 
\J litv tann4 

J^ + £^ 1/3 ) = (2/i/) 1 / 3 Ai(-2 1 / 3 ^) + 0(^- 1 ) (35) 

Mvsect) = J l {cos[f -^-tanOJ + O^- 1 )} , 0<£<^ (36) 
V 7r^tan4 2 



where Ai(-) is an Airy function 28]. These three relations show that for \k — j\ 3> 1, G(j,k,t) is 
exponentially small in \k — j\ for t < 0.99 • \k — j\/2, of order \k — for t near |/c — j\/2, and 

of order |fc - j\~ 1 ^ 2 for t > 1.01 • \k - j\/2. 

To understand the effect of a defect, we now consider an infinite line with a defect between 
sites j = d and j = d + 1, as shown in |](c). For generality, we consider the case where the matrix 
element across the defect is a. We use standard scattering theory to calculate the transmission 
coefficient for an incident plane wave of momentum p > 0. Consider a state consisting of an 
incident plane wave and a reflected plane wave on the left side of the defect and a transmitted 
plane wave on the right side: 



0W = ^ ~ ^ " ^ n (37) 




Here 1Z is the reflection coefficient and T is the transmission coefficient. Requiring this to be an 
eigenstate of the Hamiltonian, we find 

tv ^ 2iasinp 

(cr — 1) cosp + i{a z + 1) snip 



which gives 



,.n 8sin 2 p . , 

1 + 8 sin p 



for a = s/2, as shown in Figure ||. A narrow wave packet with momentum p propagates through 
the defect with probability \T{p)\ 2 . The wave packet that results from a state initially localized at 
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FIG. 5: The transmission probability |T(p)| 2 as a function of momentum for the infinite line with a defect 
(with a = \/2). 

a particular site is spread out over a range of momenta, but since the transmission probability is 
appreciable over most of the range, it is clear that there will be substantial transmission through 
the defect. 

Finally, to show that boundaries do not impede the propagation, we now consider the finite line 
(without a defect) shown in Figure ^d). This problem can be treated by standard techniques of 
multiple reflection. The exact Green's function G(j, k, t) for this finite line in terms of the Green's 
function G(j, k, t) for the infinite line is 5 

oo 

G(j, k,t)= [G(j, k + 2l(L + 1), t) - G(j, -k + 2l(L + 1), t)) , 1 < j, k < L . (40) 

/=— oo 

This can be interpreted as a sum of paths making reflections off the boundaries. To verify this 
formula, the reader can check that it satisfies the Schrodinger equation, the boundary conditions, 
and the initial condition. The Schrodinger equation is satisfied because each term individually 
satisfies it for the infinite line. The boundary conditions G(j,0,t) = G(j,L + l,t) = can be 
verified by substitution. The initial condition G(j,k,0) = 5jk holds because G(j,k,0) = 5jk, and 
the only contribution at t = comes from the first term of ( flol) with / = 0. 

We will now see, using the particular form of the propagator in terms of a Bessel function, 
that propagation from j = 1 to j = L takes time L/2 for L > 1, Since J^_j(2t) is small for 
| A; — j\ 3> 2i, there are only four terms that contribute significantly for t > L/2. They result from 
taking I = 0, — 1 in the first term of ( f40"D and / = 0, 1 in the second term. The resulting expression 
is 

G(l,L,t)nG(l,L,t) + G(l,-L-2,t)-G(l,-L,t)-G(l,L + 2,t), t>L/2, (41) 

the magnitude of which is not small. 

We have seen that propagation on a line occurs as a wave packet with speed 2, that the wave 
packet is substantially transmitted through a defect, and that reflections off boundaries do not 



5 Note that (^(J) is the exact formula for propagation in the graph G n shown in Figure [l] and studied in JItJ if we 
use (B) instead of (0) as the definition of a quantum walk. 
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impede propagation. Taken together, these facts constitute compelling evidence that the quantum 
walk traverses the graph G' n in linear time. The exact propagator for the line shown in Figure ||(a) 
can be calculated using a more sophisticated version of these techniques [29]. This exact propagator, 
evaluated for t near n, is of order n™ 1 / 3 . We spare the reader the details of this calculation and 
give a simpler proof of a bound that is not tight — but is nevertheless polynomial — in the following 
section. 



D. Upper bound on the hitting time 

Although the preceding section demonstrated beyond any reasonable doubt that the quantum 
walk traverses the graph G' n in linear time, we now provide a simple proof that the hitting time is 
upper bounded by a polynomial. 

For the purpose of this proof, it will be more convenient to consider the graph G' n _ 1 , which 
reduces to a line with 2n vertices. We label the vertices from 1 to 2n, and the defect is on the edge 
between vertices n and n + 1. With this labeling and 7 = l/y/2, the Hamiltonian fl27| ) is 

/ , -,r T i ,/■ fl 1 < j < n- 1, n + 1 < j < 2n- 1 

(cd3\H\<xA(j + l)) = l^.Z J n - ~ J - (42) 

with Hermiticity of H giving the other nonzero matrix elements. 
Define a reflection operator 

R\ col j) = I col(2n + 1 - j)) . (43) 

Note that R 2 = 1, so R has eigenvalues ±1. R commutes with H on the column subspace, so we 
can find simultaneous eigenstates of R and H. These are of the form 

/ 1 -i p\ — / sm PJ 1 < j < n 

{C Jl ' ~ \ ±sin(p(2n + l-i)) n + l<j<2n, 1 ' 

which explicitly vanish at j = and j = 2n + 1. The eigenvalue corresponding to the eigenstate 
\E) is E = 2cosp, and the quantization condition (to be discussed later) comes from matching at 
vertices n and n + 1. The entrance vertex corresponds to | col 1) and the exit vertex to | col 2n). 

Lemma 1 Consider the quantum walk in G' n _ 1 starting at the entrance. Let the walk run for a 
time t chosen uniformly in [0, r] and then measure in the computational basis. If r > for any 
constant e > 0, where AE is the magnitude of the smallest gap between any pair of eigenvalues of 
the Hamiltonian, then the probability of finding the EXIT is greater than ^(1 — e). 

Proof The probability of finding the EXIT after the randomly chosen time t G [0, r] is 

- [ T dt\(col2n\e- iHt \coll}\ 2 
T Jo 

= -J2 [ T dte- i{E - E,)t (col 2n\E)(E\ coll) (col 1\E')(E'\ col 2n) (45) 

T E,E' ^° 

= £|(£|coll>| 2 |(£|col2n>| 2 



_ l- e -i(E-E')r 

+ zZ W\ (col2n|S)( J B|coll)(coll|E')(£; / |col2n). (46) 

E+E , AE-E)r 
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Because of (44), we have (E\ col 1) = ±{E\ col2n). Thus the first term is 

£ \(E\ col 1)| 4 >i- 



(47) 



as is easily established using the Cauchy-Schwartz inequality. The second term can be bounded as 
follows: 

' 1 _ e ~i(E-E')r 

Yl ~TB S7^( co1 2n \ E ) ( E \ co1 !) ( co1 il-E') (-^l co1 2n > 



^7A^^ l(jB|coll)|2|(jB,|c ° 12n)l ' 



E,E' 



tAE 



(48) 



Thus we have 



1 

T Jo 



di|(col2n|e- im |coll)|^ > 



2 1 , 



2n rA£ ~ 2n 
where the last inequality follows since r > by assumption. ■ 

Now we need to prove that the minimum gap AE is only polynomially small. 
Lemma 2 The smallest gap between any pair of eigenvalues of the Hamiltonian satisfies 



(49) 



AE > 



2tt 2 



(1 + V2> 3 



+ 0(l/n 4 



(50) 



Proof To evaluate the spacings between eigenvalues, we need to use the quantization condition. 
We have 



so that 



(co\n\H\E) = 2 cos p (coin | £) 



V2(col(n + 1)\E) + (col(n - 1)\E) = 2 cosp (col n\E) 



and using (44), we have 



which simplifies to 



± \/2sinnp + sin((n — l)p) = 2cosp sinnp 
sin((n + l)p) 



sm np 



±V2. 



(51) 



(52) 



(53) 



(54) 



In Figure ^ we plot the left hand side of ([54}) for n = 5. The intersections with —y/2 occur to 
the left of the zeros of sinnp, which occur at irl/n for I = 1, 2, . . . , n — 1. For the values of p that 
intersect — y/2, we can write p = (jrl/n) — 5. Equation (]54|) with — \/2 on the right hand side is 
now 



y/2 sin nd = sin ( nS \- 5 ) . 

n 



(55) 
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V2 




FIG. 6: Left hand side of 



for n 



Write 5 = (c/n) + (d/n 2 ) + 0(l/n 3 ). Taking n —* oo in ( |55| ) gives — \/2sinc = sine, which implies 
that c = 0. We then get 

_ ^2 sin + 0(l/n 2 )) = sin f- - — + 0(l/n 2 )^) (56) 
\n y \n n y 

which gives, as n — ► oo, 

d=— 1 ^-=. (57) 
1 + ^2 

Thus we have that the roots of (^4|) with — v2 on the right hand side are of the form 

p= — ^^+0(l/n 3 ). (58) 

n (1 + ^2)n 2 W ; 17 

Let p' and p" be the two roots of (|54|) closest to the root p just found, with p' < p < p" . 
From the figure we see that p' and p" both are roots of ( |54|) with +V2. (Note that the smallest p, 
corresponding to I = 1, does not have ap'.) We see that p" lies to the right of the zero of sinnp at 
p = lir/n. We also see that p' lies to the left of the zero of sin((n + l)p) at lir/(n + 1). Therefore 
we have 

p' < --^ + 0(l/n 3 ) (59) 

V" > - , (60) 
n 

from which we conclude that 

P-P > n 7^1 2 +0(l/n 3 ), Z = 2,3,...,n-1 (61) 
(1 + y2)n z 

p"-p > — -^=— + 0(l/n 3 ), / = l,2,...,n-l. (62) 



77/ 



Thus the smallest spacing is at least vr/[(l + V2)n 2 } + 0(l/n 3 ) 
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Now for a given p, the corresponding eigenvalue is 2 cos p. For small Ap, the spacing AE is 
related to the spacing Ap by 

AE = 2\Ap smp\ + O ((Ap) 2 ) . (63) 
The factor ship = sin(/7r/n + 0(l/n 2 )) is smallest when I = 1, so we have 

AE > h 0(l/n 4 ) > for n sufficiently large. (64) 

(1 + V2)n 3 n 3 

The alert reader will note from the figure with n = 5 that there are only 8 roots, whereas the 
dimension of the reduced space is 10, so there are actually 10 eigenvalues. In general, there are 
n — 2 roots of ( |54|) with p real. If we let p = ik with k real, we can have eigenstates of the form 
dHI) with sinpj replaced by sinhfcj and ± sin(p(2n + 1 — j)) replaced by ± sinh(/c(2n + 1 — j)). The 
corresponding eigenvalue is 2 cosh k and the condition ([54]) becomes 



Sinh((n + 1)fc) = ±V2. (65) 
sinh nk 

As n — > oo 3 the root of this equation is at e h = \/2, which corresponds to an eigenvalue y/2 + A^. 
To obtain the last eigenvalue, let p = tt + ifc. The eigenvalue is then —2 cosh fc. The quantization 
condition is now the same as (|65[), and as n —> oo, the eigenvalue is — (\/2 + So we have found 

two eigenvalues at ±(\/2 + -h=) with corrections that vanish exponentially as n — > oo. Since the 
other n — 2 eigenvalues are all in the range [—2,2], our conclusion about the minimum spacing is 
unchanged. ■ 

Using Lemma |l] and Lemma ^, we find 

Theorem 3 For n sufficiently large, running the quantum walk for a time chosen uniformly in 
[0, y~] and then measuring in the computational basis yields a probability of finding the exit that 
is greater than ^-(1 — e). 

To summarize, we have presented an efficient algorithm for traversing any graph G' n using a 
quantum computer. The computer is prepared in the state corresponding to the entrance, and 
the quantum walk is simulated using the construction described in Section [IIIB . After running 



the walk for a certain time t, the state of the computer is measured in the computational basis. 
The oracle can then be used to check whether the resulting vertex name corresponds to a vertex of 
degree 2 other than entrance, in which case it must be exit. Theorem || shows that by choosing 
an appropriate t = poly(n), the probability of finding the name of the exit can be 0(l/n). By 
repeating this process poly(n) times, the success probability can be made arbitrarily close to 1. 
Combining this with the efficient implementation of the quantum walk described in Section [III B , 



we see that the quantum walk algorithm finds the name of the exit with high probability using 
poly(n) calls to the oracle. 



IV. CLASSICAL LOWER BOUND 

We now prove that no classical algorithm can find the exit with high probability in subexpo- 
nential time. We do this by considering a series of games and proving relations between them. 
The first game is equivalent to our problem, and each new game will be essentially as easy to win. 
Finally, we will show that the easiest game cannot be won in subexponential time. 
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Until now, we have not defined the specific coloring of the edges of the graph. We did not need 



to consider a particular coloring in Section III because the quantum algorithm works given any 
consistent coloring. However, to prove the classical lower bound, we need to specify a coloring that 
does not supply information about the graph. The coloring is chosen at random as follows. At each 
vertex in an even numbered column, randomly color the incident edges A, B, C. At each vertex in 
an odd numbered column, randomly append 1,2,3 to the colors of the incident edges. The edges 
are then colored with one of nine colors, Al, A2, A3, Bl, . . . , C3. Because of the structure of G' n , 
any such coloring is consistent, but as we will see below, it does not provide any useful information 
to a classical algorithm. 

Our problem is equivalent to the following game: 

Game 1 The oracle contains a random set of names for the vertices of the randomly chosen graph 
G' n such that each vertex has a distinct In-bit string as its name and the entrance vertex has the 
name 0. In addition, the edges of the graph are randomly colored as described above. At each step, 
the algorithm sends a 2n-bit string to the oracle, and if there exists a vertex with that name, the 
oracle returns the names of the neighbors of that vertex and the colors of the edges that join them. 
The algorithm wins if it ever sends the oracle the name of the exit vertex. 

Note that there are three sources of randomness in this oracle: in the choice of a graph G' n , in the 
random naming of its vertices, and in the random coloring of its edges. We first consider a fixed 
graph G and coloring C and only draw implications from the random names. Throughout this 
section, G always refers to one of the graphs G' n . For a game X with a graph G and a coloring C, 
the success probability of the algorithm A is defined as 

F x ' (A) = Pr [algorithm A wins game X on graph G with coloring C] (66) 



where Pr [•] means the probability is taken over the random naming of vertices. 

names 

In Game ||, the algorithm could traverse a disconnected subgraph of G' n . But because there are 
exponentially many more strings of 2n bits than vertices in the graph, it is highly unlikely that 
any algorithm will ever guess the name of a vertex that it was not sent by the oracle. Thus, Game 
H is essentially equivalent to the following game: 

Game 2 The oracle contains a graph, set of vertex names, and edge coloring as described in Game 
|7|. At each step, the algorithm sends the oracle the name of the entrance vertex or the name of a 
vertex it has previously been sent by the oracle. The oracle then returns the names of the neighbors 
of that vertex and the colors of the edges that join them. The algorithm wins it ever sends the 
oracle the name of the exit vertex. 

The next lemma shows that, if the algorithms run for a sufficiently short time, then the success 
probabilities for Game |l| and Game || can only differ by a small amount. 

Lemma 4 For every algorithm A for Game [J that makes at most t oracle queries, there exists an 
algorithm A 1 for Game that also makes at most t oracle queries such that for all graphs G and 
all colorings C , 

F°' C (A) < if ' C (A') + Q{t/2 n ) . (67) 



Proof Algorithm A' simulates A, but whenever A queries a name it has not previously been sent 
by the oracle, A' assumes the result of the query is 11 ... 1. The chance that A can discover the 
name of a vertex that it is not told by the oracle is at most t (2 n+2 — 2)/ 2 2n , and unless this happens, 
the two algorithms will have similar behavior. ■ 
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Having restricted the algorithm to traverse a connected subgraph, we will now show how to 
eliminate the coloring. Consider the following game, which is the same as Game || except that the 
oracle does not provide a coloring: 

Game 3 The oracle contains a graph and a set of vertex names as described in Game [J. At each 
step, the algorithm sends the oracle the name of the entrance vertex or the name of a vertex it 
has previously been sent by the oracle. The oracle then returns the names of the neighbors of that 
vertex. The algorithm wins it ever sends the oracle the name of the exit vertex. 

For games that do not involve a coloring, we define the success probability as 

Fx(A) = Pr [algorithm A wins game X on graph G] . (68) 

names 

The next lemma shows that Game || and Game || are equivalent: 

Lemma 5 For any algorithm A for Game [| that makes t queries to the oracle, there is an algorithm 
A' for Game [| that also makes at most t queries to the oracle such that for all graphs G, 

= lg(A') • (69) 

Here Ec [■] means the expectation is taken over the random coloring of edges. 

Proof The only information needed to make up a coloring is whether a vertex is in an even or odd 
column, and this information is always available to an algorithm that can only traverse a connected 
subgraph. Thus A' can make up its own random coloring as it goes, and have the same probability 
of success as A. ■ 

To obtain a bound on the success probability of Game ||, we will compare it with a simpler 
game, which is the same except that it provides an additional way to win: 

Game 4 The oracle contains a graph and a set of vertex names as described in Game rj. At each 
step, the algorithm and the oracle interact as in Game [|. The algorithm wins it ever sends the 
oracle the name of the exit vertex, or if the subgraph it has seen contains a cycle. 

Game |] is clearly easier to win than Game ||, so we have 

Lemma 6 For all algorithms A for Game [|, 

T$(A)<Tfi(A). (70) 

Now we further restrict the form of the subgraph that can be seen by the algorithm unless it 
wins Game |j. We will show that the subgraph an algorithm sees must be a random embedding 
of a rooted binary tree. For a rooted binary tree T, we define an embedding of T into G to be 
a function tt from the vertices of T to the vertices of G such that 7t(root) = entrance and for 
all vertices u and v that are neighbors in T, tt(u) and tt(v) are neighbors in G. We say that an 
embedding of T is proper if tt(u) ^ tt(v) for u ^ v. We say that a tree T exits under an embedding 
7r if 7r(f ) = EXIT for some v £ T. 

We must specify what we mean by a random embedding of a tree. Intuitively, a random 
embedding of a tree is obtained by setting 7t(root) = entrance and then mapping the rest of 
T into G at random. We define this formally for trees T in which each internal vertex has two 
children (it will not be necessary to consider others). A random embedding is obtained as follows: 



E 

n 



^ C (A) 
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1. Label the ROOT of T as 0, and label the other vertices of T with consecutive integers so that 
if vertex i lies on the path from the root to vertex j, then i is less than j. 

2. Set 7r(0) = ENTRANCE. 

3. Let i and j be the neighbors of in T. 

4. Let u and v be the neighbors of entrance in G. 

5. With probability 1/2 set ir(i) = u and ir(j) = v, and with probability 1/2 set ir(i) = v and 
vr(j) = u. 

6. For z = 1,2,3,..., if vertex i is not a leaf, and ir(i) is not exit or entrance, 

(a) Let j and k denote the children of vertex i, and let I denote the parent of vertex i. 

(b) Let u and v be the neighbors of ir(i) in G other than 7r(Z) . 

(c) With probability 1/2 set ir(i) = u and Tr(j) = v, and with probability 1/2 set 7r(i) = v 
and 7r(j) = u. 

We can now define the game of finding a tree T for which a randomly chosen ir is an improper 
embedding or T exits: 

Game 5 The algorithm outputs a rooted binary tree T with t vertices in which each internal vertex 
has two children. A random tt is chosen. The algorithm wins if tt is an improper embedding of T 
in G' n or ifT exits G' n under tt. 

As the algorithm A merely serves to produce a distribution on trees T, we define 

P (T) = Pr [tt is an improper embedding of T or T exits G under tt] , (71) 

7T 

and observe that for every distribution on graphs G and all algorithms taking at most t steps, 

maxEpPfU)l< max E [P G (T)1 . (72) 

A G trees T with t vertices G 

Game |] and Game |B| are also equivalent: 

Lemma 7 For any algorithm A for Game that uses at most t queries of the oracle, there exists 
an algorithm A' for Game |^ that outputs a tree of at most t vertices such that for all graphs G, 

F$(A) = Fj(A') . (73) 

Proof Algorithm A halts if it ever finds a cycle, exits, or uses t steps. Algorithm A' will generate 
a (random) tree by simulating A. Suppose that vertex a in graph G corresponds to vertex a' in the 
tree that A' is generating. If A asks the oracle for the names of the neighbors of a, A' generates two 
unused names b' and d at random and uses them as the neighbors of a! . Now b' and d correspond 
to b and c, the neighbors of a in G. Using the tree generated by A' in Game || has the same 
behavior as using A in Game |j. ■ 

Finally, we bound the probability that an algorithm wins Game a 
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Lemma 8 For rooted trees T of at most 2 n / 6 vertices, 

maxE \F G (T)] < 3 • 2-' n l % 

Proof Let T be a tree with t vertices, t < 2 n / 6 , with image vr(T) in G' n under the random 
embedding it. The vertices of columns n + 1, n + 2, . . . n + § in divide naturally into 2™/ 2 
complete binary subtrees of height n/2. 

(i) It is very unlikely that tt(T) contains the root of any of these subtrees, i.e., that tt(T) includes 
any vertex in column n + ^ . Consider a path in T from the root to a leaf. The path has 
length at most t, and there are at most t such paths. To reach column n + ^ from column 
n + 1, 7r must choose to move right § — 1 times in a row, which has probability 2 1_n / 2 . Since 
there are at most t tries on each path of T (from the ROOT to a leaf) and there are at most 
t such paths, the probability is bounded by t 2 ■ 2 1 ~ n / 2 . 

(ii) If vr(T) contains a cycle, then there are two vertices a, b in T such that vr(a) = vr(6). Let P 
be the path in T from a to 6. Then 7r(P) is a cycle in G^. Let c be the vertex in T closest 
to the root on the path vr(P), and let 7r(P) consist of the path vr(Pi) from c to a and vr(P2) 
from c to 6. 

Let Si, S2, ■ ■ ■ , S 2 n/2 denote the 2 n l 2 subtrees described above. Let S[,S' 2 , ■ ■ ■ , S' 2n/2 denote 
the corresponding subtrees made out of columns | + 1 to n. Without loss of generality, let 
7r(c) be in the left tree of G' n , i.e., in a column < n, as shown in Figure |?]. 

Now 7r(Pi) visits a sequence of subtrees S- , S^, S' i2 , — Similarly vr(P2) visits a sequence 
of subtrees S' ki , S^, S' k2 , . . .. Since ir(a) = vr(6), the last subtree on these two lists must be 
the same. (The other possibility is that ir(a) = nib) does not lie in any subtree, hence lies 
in columns 1 through 8 or n + 5 + 1 through 2n. But the event that column n + ^ is ever 
reached has already been shown to be unlikely in part (i). The same argument bounds the 
probability of a return to column ^ after a visit to column n + 1.) At least one of the lists 
has more than one term (or all vertices visited are in the left tree, which can't make a cycle). 
The probability that the last terms on the two lists agree is bounded by 2 n l 2 /{2 n -t),by the 
construction of the random cycle that connected the two trees of G' n . As long as t < 2 n_1 , we 
have 2 n / 2 /(2 n -t) <2-2-' n l 2 . Since there are LI paths P to be considered, the probability 
of a cycle is less than t 2 ■ 2~ n l 2 . 

Overall we have shown that 

E[F G (T)] < t 2 ■ 2~ n/2 + t 2 ■ 2 1 - n/2 

G 

< 3-2" n/6 

if t < 2 n / 6 . ■ 

We have proved the following. 

Theorem 9 Any classical algorithm that makes at most 2 n / 6 queries to the oracle finds the exit 
with probability at most 4 • 2 -n / 6 . 



(74) 



(75) 
(76) 
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f n n + 1 n + § 2n + 1 




FIG. 7: Graphical representation of part (ii) of the proof of Lemma |[ The triangles represent the subtrees 
of G' n of height n/2, the dashed line represents the path tt(Pi), and the dotted line represents the path 
7r(P 2 )- Together, these paths form a cycle in the graph. 

V. DISCUSSION 

In this paper, we have applied a general implementation of (continuous time) quantum walks to 
an oracular problem, and we have proved that this problem can be solved efficiently by a quantum 
computer, whereas no classical algorithm can do the same. We considered the problem of finding 
the name of the exit of a particular graph starting from the entrance, given an oracle that 
outputs the names of the neighbors of an input vertex. Note that although our algorithm finds the 
name of the EXIT, it does not find a particular path from ENTRANCE to EXIT. 

We can also view our problem as a decision problem by asking whether the first bit of the name 
of the exit is or 1. Therefore, our result can be also interpreted as showing the existence of a new 
kind of oracle relative to which BQP ^ BPP ||, H|. We also note that, although it is convenient 
to express our results in terms of a graph traversal problem, the results can also be cast in terms 
of a graph reachability problem, where one is given a graph and two vertices and the goal is to 
determine whether there is a path connecting those vertices. 

To efficiently simulate the quantum walk on a general graph, we required a coloring of its edges. 
In the specific case of a quantum walk on a bipartite graph starting at the entrance, the walk 
can be constructed without a coloring, as we describe in Appendix ||. It is an open question 
whether one can find other techniques for implementing quantum walks. In particular, we do not 
know whether it is possible to efficiently simulate a quantum walk on an arbitrary uncolored graph 
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without any restriction on the structure of the graph or the initial state. 

Many computational problems can be recast as determining some property of a graph. A 
natural question is whether there are other interesting computational problems (especially non- 
oracular ones) that are classically hard (or are believed to be classically hard) but that can be 
solved efficiently on a quantum computer employing quantum walks. 
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APPENDIX A: AN EFFICIENT CLASSICAL ALGORITHM TO TRAVERSE THE 

HYPERCUBE 

In this appendix we describe a classical algorithm that traverses the hypercube graph, where 
entrance is any vertex and exit is defined to be the unique vertex whose distance from entrance 
is n. 

The idea of the algorithm is to start at entrance and repeatedly move one level closer to exit, 
where level k is the set of vertices whose minimum distance from entrance is k. In other words, 
the algorithm will construct a sequence of vertices ao = entrance, a±, . . . , a n _i, a n = exit, where 
dfc is in level k. To choose the vertex a^+i, the algorithm will also require a set of vertices <Sfc_i, 
which is the set of all neighbors of that are at level k — 1. Note that every neighbor of ai~ is 
either at level k — 1 or k + 1. 

The algorithm proceeds as follows. First, let a\ be any neighbor of ao and let Sq = {ao}- Now 
suppose that (for some k) and S^-i are known. Then let a^+i be any neighbor of that is 
not in Sfc_i, and let St contain every neighbor of at+i that is also a neighbor of some element of 
Sfc_i. The key point is that the set constructed in this way is in fact the set of all neighbors of 
a fc+i whose distance from ao is k. After n such steps, the algorithm reaches a n = exit. Each step 
takes 0(n) queries, so the total number of queries is 0(n 2 ). 

APPENDIX B: IMPLEMENTATION OF THE QUANTUM WALK STARTING FROM A 
PARTICULAR VERTEX OF A BIPARTITE GRAPH 

In this appendix we outline an implementation of the quantum walk on a bipartite graph with 
the initial state given by entrance in the case where the oracle does not provide an edge coloring. 
That is, the oracle is still given by (^), but now v c (v c (a)) need not equal a. 

This implementation uses the fact that, in any case, the neighbors of a vertex must be given in 
some order, and this provides a coloring of the directed edges. For a bipartite graph, this can be 
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used to construct a consistent coloring of the undirected graph. For our particular graphs G' n , the 
construction is similar to the nine color construction found in Section [V. 

The construction of the coloring requires a parity bit indicating which side of the bipartite 
graph a vertex is in, and thus essentially requires that the initial state is a particular vertex (e.g., 
the entrance) and not a general superposition. The entrance is defined to be on side of the 
bipartition, so the initial state has the parity bit equal to 0. By flipping the value of the parity bit 
each time the oracle is queried, the algorithm can keep track of the parity of each vertex. In other 
words, the name of each vertex can be assumed to contain a special bit that indicates which side 
of the bipartition the vertex is on. 

Using the parity bit, we can combine the colors of the directed edges to form a consistent 
coloring of the undirected edges. For vertices with parity 0, the color of each adjacent undirected 
edge is (incoming color, outgoing color), and for vertices with parity 1, the color of each adjacent 
undirected edge is (outgoing color, incoming color). The color of an adjacent undirected edge can 
be easily computed using the oracle and the parity bit, and it is also easy to compute whether 
there is an undirected edge of a particular color incident on a given vertex. Thus, the oracle that 
provides this consistent coloring of the undirected edges can be simulated using the oracle that 
does not provide an edge coloring. 
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